If it's any form of token, a legitimate product could be obtained and resold or returned without the token or with a fake. (How would it be validated prior to use; and if you did provide that oracle, how would you prevent botfarm abuse checking codes?)
The serial number on the product and a token to claim that number as a pair would work, at least in so far as someone would then have to obtain a large number of units and fake exact numbers. That should increase the chance of tracing a buyer; more so if the unit number is also on the outside of the box and it's registration can be checked prior to opening the box.
The serial number on the product and a token to claim that number as a pair would work, at least in so far as someone would then have to obtain a large number of units and fake exact numbers. That should increase the chance of tracing a buyer; more so if the unit number is also on the outside of the box and it's registration can be checked prior to opening the box.